Jul 2026· International Conference on Climate Informatics· Vol 42· 0 citations· 28 references
TL;DR
AlquistCoder, a compact 3.8B‐parameter coding assistant designed to address both risks through targeted synthetic‐data alignment, is introduced and publicly released to support reproducible research on security alignment for code‐generation models.
Abstract
Large language models are increasingly used as programming assistants, but their security behavior remains uneven: they may generate code with vulnerable patterns, and they may provide actionable help for malicious requests. This paper introduces AlquistCoder, a compact 3.8B‐parameter coding assistant designed to address both risks through targeted synthetic‐data alignment. Starting from Phi‐4‐mini, we train the model with supervised fine‐tuning and direct preference optimization on data produced by our constitution‐guided Design–Amplify–Refine framework, which generates secure‐coding examples, refusal demonstrations, and preference pairs from structured specifications of vulnerability classes, coding domains, and malicious‐intent patterns. We evaluate AlquistCoder on CyberSecEval, HumanEval, SecurityEval, and two benchmarks released with this work: VulnBench, for hard Python secure‐coding prompts, and MalBench, for multi‐turn adversarial manipulation. Across these benchmark‐level evaluations, AlquistCoder reduces statically detected vulnerability patterns and judged malicious‐assistance rates relative to its base model and to baselines of comparable or larger size, while retaining competitive coding performance for its size. We publicly release the trained model, datasets, benchmarks, and evaluation scripts to support reproducible research on security alignment for code‐generation models.
AI coding agents powered by LLMs are increasingly integrated into real-world software development, where they generate, edit, and execute code with autonomous access to local files and tools. Coding agents inherit security risks from both the LLM backbone, where adversarial prompts, poisoned training data, and backdoor triggers can cause models to emit insecure or attacker-chosen code, and their agentic architecture, where tool-using autonomy enables induced misuse of external APIs, data exfiltration, and persistent compromise of development environments. This paper presents a systematic evaluation of malicious issue requests against state-of-the-art coding agents (Cursor, Claude Code, and Codex Desktop), powered by two major model families (OpenAI GPT-5.3 Codex/GPT-5.4 and Anthropic Sonnet 4.6). Our novel benchmark IssueTrojanBench contains malicious issues that are constructed based on four novel attack categories (i.e., embedded as malicious instructions in issues), six delivery vectors (e.g., PDF, or issue comment), and further augmented by perturbations. Our results reveal critical vulnerabilities in the as-deployed modern coding agents, i.e., 66.5% of the malicious issues from IssueTrojanBench penetrate all the guardrails (agent- and LLM-level) of coding agents. Our further analysis shows that rejection is almost entirely from LLMs rather than the agent frameworks, with GPT models broadly vulnerable and Sonnet 4.6 exhibiting more selective, risk-aware blocking of high-impact actions. Our evaluation also highlights that the current agent-level defense strategy offers limited additional protection for coding agents. Our findings highlight the urgent need for stronger agent- and model-level safety mechanisms to protect AI coding agents.
The first systematic study of model editing as a model-level hardening mechanism for secure code generation is conducted, evaluating 3 state-of-the-art editing methods across diverse LLM families and comparing them with CoSec, a representative inference-time approach, focusing on security, robustness, generalization, and functional correctness.
Weifeng Sun, Quanjun Zhang, Yuchen Chen et al.· 0 citations
A novel method is developed, SecVecCoder, leveraging task vectors to produce trustworthy code that is simultaneously functional and secure without the need for post-generation adjustment, and achieves a decoding latency within 0.6% of the base model's, on average.
F. Wang, Anudeep Das, M. Nagappan et al.· 0 citations
Large language models have enabled powerful code completion systems that assist developers by predicting subsequent lines of code. However, these models remain vulnerable to backdoor attacks, where malicious fine-tuning data covertly implants unsafe behaviors. Despite advances in defensive techniques, adaptive and sophisticated backdoor attacks still evade detection and mitigation. We present CodeTracer, a forensic framework that traces malicious code completions back to the backdoor fine-tuning data responsible for them. Operating under realistic post-deployment constraints, CodeTracer relies solely on the fine-tuning corpus and the reported miscompletion event. It extracts a structured behavioral fingerprint from the compromised output, narrows the search to semantically relevant code samples, and employs LLM-based reasoning to attribute unsafe logic to specific backdoor data. Extensive evaluations across three representative vulnerability cases and ten backdoor attacks, along with sixteen competitive baselines, demonstrate that CodeTracer consistently achieves high forensic accuracy, low false identification rates, and strong robustness against adaptive attacks.
Anjun Gao, Yueyang Quan, Zhuqing Liu et al.· 2 citations
This work presents a two-phase evaluation of ten Llama variants using the OWASP Top 10 for LLM Applications, and applies nine encoding obfuscations to the same prompts, which fully bypasses all text-only models.
Nourin Shahin, I. Alsmadi· Practice and Experience in A...· 0 citations